Extracted

• • Target

    JaffaCakes118_bdfbad24823efd565125cb8da4ae9653

  • Size

    232KB

  • MD5

    bdfbad24823efd565125cb8da4ae9653

  • SHA1

    179611965f7aedc7bf0358060b2ca771484af96f

  • SHA256

    9ba80e9f76390bcef1a6d1ec98a95902c9cf0d62f892d4aeacc2c14a3df9305e

  • SHA512

    855e17844653f6b5bb5ae20a67e656a2b100f1f3795084fa84541b4dc3940750b9467bf8c997f7c7da74dd9261d66bc80ab0898590dc4202ccfc5f56d81a2f26

  • SSDEEP

    6144:u38kLuEmOYcsSeyruz3SAKaUdOCBbUZdlrVQ:uFLm2BbUZdl

  Score

  10^/10

  njrathhhhhhevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2